CAPEC-81 Metadata
Likelihood of Attack
Medium
Typical Severity
High
Overview
Summary
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.
Prerequisites
Target server software must be a HTTP server that performs web logging.
Execution Flow
| Step | Phase | Description | Techniques |
|---|---|---|---|
| 1 | Explore | [Determine Application Web Server Log File Format] The attacker observes the system and looks for indicators of which logging utility is being used by the web server. |
|
| 2 | Experiment | [Determine Injectable Content] The attacker launches various logged actions with malicious data to determine what sort of log injection is possible. |
|
| 3 | Exploit | [Manipulate Log Files] The attacker alters the log contents either directly through manipulation or forging or indirectly through injection of specially crafted request that the web server will receive and write into the logs. This type of attack typically follows another attack and is used to try to cover the traces of the previous attack. |
|
Potential Solutions / Mitigations
Design: Use input validation before writing to web log Design: Validate all log data before it is output
Related Weaknesses (CWE)
| CWE ID | Description |
|---|---|
| CWE-20 | Improper Input Validation |
| CWE-75 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') |
| CWE-96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') |
| CWE-116 | Improper Encoding or Escaping of Output |
| CWE-117 | Improper Output Neutralization for Logs |
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences |
| CWE-221 | Information Loss or Omission |
| CWE-276 | Incorrect Default Permissions |
| CWE-279 | Incorrect Execution-Assigned Permissions |
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-268 | The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions. |
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.